3d6a6e8d03f0b291d9709a0d623b01f76d3f92f3fe395b6f57027cc9e892aa30

General

Target

c69b2b190f08dc6bb255a2c0ce1c148b.exe
Size

591KB
MD5

c69b2b190f08dc6bb255a2c0ce1c148b
SHA1

b3d29e545e0b3fb9e83968c3b6d0f3c7dbee67f4
SHA256

3d6a6e8d03f0b291d9709a0d623b01f76d3f92f3fe395b6f57027cc9e892aa30
SHA512

22b6e29ac922ee42be11fcf452611a0889380dd62503d7db144373c44b61d57c4cf738710bbb3517ac6edc8fbaebfd7031b6a57ab5eab6d2e87ddde2c8f8dc04
SSDEEP

12288:2GpuMpm+gvyQqbxxFWBJqWjdgPwnnqoqxJ2fUkVRVRty1+ZWu:lpuLmbxKTdAQA2rlRt0u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c69b2b190f08dc6bb255a2c0ce1c148b.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe
2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2772	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	31
PID 2612 wrote to memory of 2772	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	31
PID 2612 wrote to memory of 2772	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	31
PID 2612 wrote to memory of 2772	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	31
PID 2612 wrote to memory of 840	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	32
PID 2612 wrote to memory of 840	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	32
PID 2612 wrote to memory of 840	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	32
PID 2612 wrote to memory of 840	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	32
PID 2612 wrote to memory of 2184	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	33
PID 2612 wrote to memory of 2184	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	33
PID 2612 wrote to memory of 2184	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	33
PID 2612 wrote to memory of 2184	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	33
PID 2612 wrote to memory of 2784	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	34
PID 2612 wrote to memory of 2784	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	34
PID 2612 wrote to memory of 2784	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	34
PID 2612 wrote to memory of 2784	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	34
PID 2612 wrote to memory of 2308	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	35
PID 2612 wrote to memory of 2308	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	35
PID 2612 wrote to memory of 2308	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	35
PID 2612 wrote to memory of 2308	2612	c69b2b190f08dc6bb255a2c0ce1c148b.exe	35

C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
"C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
  "C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
  "C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
  2⤵
  PID:840
- C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
  "C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
  "C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe
  "C:\Users\Admin\AppData\Local\Temp\c69b2b190f08dc6bb255a2c0ce1c148b.exe"
  2⤵
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2612-1-0x00000000003E0000-0x0000000000478000-memory.dmp

Filesize
608KB

Download
memory/2612-2-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-3-0x00000000006E0000-0x00000000006F8000-memory.dmp

Filesize
96KB

Download
memory/2612-4-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2612-5-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2612-6-0x0000000004D70000-0x0000000004DD2000-memory.dmp

Filesize
392KB

Download
memory/2612-7-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing